--- title: "Why Should Data Governance Rules Be Readable by AI Agents?" url: "https://atlan.com/know/data-governance/why-should-data-governance-rules-be-readable-by-ai-agents/" description: "Data governance rules should be readable by AI agents so each agent checks access, purpose and masking rules before it acts, and leaves an audit trail." author: "Emily Winks" author_role: "Data Governance Expert" published: "2026-10-21" updated: "2026-10-21T00:00:00.000Z" --- > Atlan is hosting Context Conference, bringing together the leaders and builders at the frontier of giving AI the context it needs to understand their business. It runs online on October 28, 2026, from 11:00 AM to 2:00 PM ET. Atlan co-founder Prukalpa Sankar opens and closes the day. Leaders from AstraZeneca, BNY and Verizon share why they invest in context and what they get from it. Registrants get early access to The AI Context Gap, a new study from MIT Technology Review Insights. Register: https://atlan.com/context-conference/ ## Why should data governance rules be readable by AI agents? Data governance rules should be readable by AI agents because an agent can only follow a rule it can read at the moment it acts. A policy in a PDF reaches people through training and review, and an agent gets neither, so the rule has to arrive as structured metadata the agent checks before it retrieves, joins or writes data. Readable rules also record which rule allowed each action, the evidence auditors and regulators now ask for. The parts of a rule an agent can read: - **Classification:** Treats the column as sensitive before it queries - **Scope and purpose:** Refuses when the user or task falls outside - **Action on breach:** Applies the outcome without improvising - **Owner:** Routes an exception to someone who can approve it ## Key takeaways - An agent can only follow a rule it can read at the moment it acts. - A rule the agent cannot read is a control that does not exist for that agent. - A rule can only be checked before retrieval if the retrieval layer can look it up on the asset. - With machine-readable rules, each log entry can name the rule that allowed or blocked an action. --- Data governance rules should be readable by AI agents because an agent can only follow a rule it can read at the moment it acts. A policy in a PDF reaches people through training and review, and an agent gets neither, so the rule has to arrive as [structured metadata](https://atlan.com/know/ai-agent/data-for-ai/types-of-metadata-for-ai-agents/) the agent checks before it retrieves, joins or writes data. Readable rules also record which rule allowed each action, the evidence auditors and regulators now ask for. --- ## What goes wrong when governance rules are written only for people? Classic [data governance](https://atlan.com/know/data-governance-vs-ai-governance/) assumes a human reader who absorbs the policy and applies judgment when a table looks sensitive. Access is granted up front and reviewed later. [A data platform vendor's comparison of agent and traditional governance](https://promethium.ai/guides/ai-agent-data-governance-vs-traditional-data-governance/) puts the break plainly: people infer what "customer" means from experience, agents need definitions they can parse, and every agent action has to be checked against machine-readable policy before it runs. The gap shows up in survey data. A [2026 risk forecast from a data security vendor](https://www.kiteworks.com/cybersecurity-risk-management/ai-agent-data-governance-why-organizations-cant-stop-their-own-ai/), which polled 225 security, IT and risk leaders, found that 63% of organizations cannot enforce purpose limits on their agents. Sixty percent cannot terminate a misbehaving agent. Picture a [finance agent](https://atlan.com/know/ai-agent/ai-agents-for-finance/) asked for revenue by customer. The table also holds personal emails. A human analyst knows the [privacy policy](https://atlan.com/know/data-privacy-for-ai-agents/) and drops the column. The agent sees a column name and a type. If "PII, mask for non-privacy roles" lives only in a policy document, nothing in the agent's path stops the join. That risk has a price. [Gartner predicts](https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027) that over 40% of agentic AI projects will be canceled by the end of 2027, and names [inadequate risk controls](https://atlan.com/know/ai-readiness/ai-risk-management/) as a cause next to rising costs and unclear value. A rule the agent cannot read is a control that does not exist for that agent. The cost side is laid out in [ROI of AI agent governance: governed vs. ungoverned access](https://atlan.com/know/ai-agent/roi-of-ai-agent-governance/). --- ## What does it mean for a governance rule to be readable by an AI agent? A readable rule is one software can evaluate without a person translating it. In her [TechTarget guide to AI-enforced governance](https://www.techtarget.com/data-technologies/tip/How-to-use-AI-to-enforce-data-governance-policies) (July 2026), Anne Marie Smith calls this policy as code: rules converted into machine-readable formats, paired with classification tags on personal, financial and IP data that owners and stewards define. [A data observability vendor's guide](https://www.acceldata.io/blog/how-governance-aware-ai-agents-enforce-data-policies) adds that the rules should sit in [a graph linking tables, users, roles and SLAs](https://atlan.com/know/enterprise-data-graph/), across five domains: security, lineage, retention, access and quality. In practice, a rule an agent can read is attached to the data and carries these parts: | Part of the rule | Example | What the agent does with it | |---|---|---| | Classification | `email` column [tagged PII](https://atlan.com/know/ai-agent/data-for-ai/how-to-handle-pii-in-ai-pipelines/) | Treats the column as sensitive before it queries | | Scope and purpose | Finance analysts, billing support only | Refuses when the user or task falls outside | | Action on breach | Mask, block or escalate | Applies the outcome without improvising | | Owner | Named data owner | Routes an exception to someone who can approve it | The format matters less than the lookup. [Catalog tags](https://atlan.com/know/data-catalog-for-ai/), YAML or JSON policy files and a policy language all work, as long as the agent, or the [tool layer](https://atlan.com/know/ai-agent/ai-agent-tool-use/) between agent and data, can find the rule for the exact asset it is about to touch. A rule that needs a human to decide what "sensitive" means fails that test. Build Your AI Context Stack Get the blueprint for implementing context graphs across your enterprise. This guide walks through the four-layer architecture, from metadata foundation to agent orchestration, with practical implementation steps for 2026. Get the Stack Guide --- ## How is agent-readable governance different from traditional governance? Traditional governance asks whether a person was allowed in. [Agent-readable governance](https://atlan.com/know/ai-agent-governance/) asks whether this action, on this asset, for this purpose, by this agent acting for this user, is allowed right now. The table draws on [a data platform vendor's comparison](https://promethium.ai/guides/ai-agent-data-governance-vs-traditional-data-governance/), [one cloud provider's AI agent governance framework](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization) and [a data integration vendor's guide to agent data governance](https://airbyte.com/agentic-data/data-governance-ai-agents). | Dimension | Rules written for people | Rules readable by AI agents | |---|---|---| | Who interprets the rule | An analyst, after training | Software, at request time | | When it is checked | At access grant, then periodic review | Before every retrieval, join or write | | Business terms | Inferred from experience | Read from certified definitions | | Identity | Static role per person | [Agent identity](https://atlan.com/know/ai-agent/ai-agent-identity/) bound to the delegating user | | Audit | What happened | What happened, which rule allowed it, for whom | | Breach response | A ticket after the fact | Mask, block or escalate inline | Identity is the row teams skip most. The cloud provider's framework gives every agent a distinct identity and, when an agent reads data for a user, makes it [inherit that user's permissions](https://atlan.com/know/ai-agent-access-control/), so an [HR helpdesk agent](https://atlan.com/know/ai-agent/ai-agents-for-hr/) shows an employee only their own record. The integration vendor's guide adds that agents should not run on a person's OAuth token, because logs would then credit the agent's actions to that person. Scope is the other break. An analyst rarely crosses from finance into HR data in one sitting. An agent answering "which high-earning customers churned" can touch billing, CRM and support systems in one plan, and each domain's rules have to be readable the same way or the strictest one gets lost at the seam. --- ## Where in an agent's workflow should it read governance rules? Early, and more than once. [A data integration vendor's guide](https://airbyte.com/agentic-data/data-governance-ai-agents), by Pedro Lopez (August 2026), names six control points: source access grant, credential issuance, admission into the [context layer](https://atlan.com/know/what-is-the-enterprise-context-layer/), [query-time retrieval](https://atlan.com/know/ai-agent/data-for-ai/what-is-retrieval-orchestration/), write-back and actions, and audit review. Its central warning is that authorization must run before retrieval, because a check after the model has answered cannot undo the exposure. That ordering is why readability matters. A rule can only be checked before retrieval if the retrieval layer can look it up on the asset. A rule in a document gets checked, at best, by a reviewer reading logs the next week. Protocols help, with limits. [The cloud provider's framework](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization) recommends the [Model Context Protocol (MCP)](https://atlan.com/know/what-is-model-context-protocol/) because it puts boundaries around what agents can reach, and tells teams to allow only [trusted MCP servers](https://atlan.com/know/ai-agent/public-vs-private-mcp-server-registry/). Lopez's guide notes that MCP does not enforce [application-specific authorization](https://atlan.com/know/ai-agent/data-for-ai/how-to-connect-enterprise-data-sources-to-llms-securely/) by itself. The protocol carries the request; the rule still has to come from somewhere the agent can read. A sound sequence: 1. Before planning, the agent reads definitions and classifications for the assets in scope. 2. Before each query, the tool layer checks the user's permissions and the asset's tags. [Lopez's guide](https://airbyte.com/agentic-data/data-governance-ai-agents) limits the agent's effective permissions to the overlap of agent and user rights. 3. Before any write, the agent checks the owner and approval rule. 4. After the run, the [audit record](https://atlan.com/know/what-are-decision-traces-for-ai-agents/) names the rule behind each step. --- ## How do machine-readable rules make agent actions auditable? An auditor asks what the agent touched and why it was allowed to. People answer the second from memory. Agents cannot, so the answer has to come from the rule that was evaluated. Regulation points the same way. [Article 12 of the EU AI Act](https://artificialintelligenceact.eu/article/12/) requires [high-risk AI systems](https://atlan.com/know/ai-readiness/the-eu-ai-act-summary/) to technically allow automatic recording of events over the system's lifetime. A log that says "query ran" records an event. A log that says "query ran under rule FIN-PII-02, column masked, owner notified" lets someone reconstruct the decision. [Lopez's guide](https://airbyte.com/agentic-data/data-governance-ai-agents) lists what each agent audit record should hold: agent identity, requested action, target system, policy result, execution outcome, data accessed and timestamp. The policy result field only has content if the policy was readable when the action ran. The evidence gap is wide. The [same security vendor's forecast](https://www.kiteworks.com/cybersecurity-risk-management/ai-agent-data-governance-why-organizations-cant-stop-their-own-ai/) found that 33% of organizations lack evidence-quality audit trails for their AI, and those organizations trail by 20 to 32 points on its AI maturity measures. [Lineage](https://atlan.com/know/ai-agent/data-for-ai/data-lineage-for-ai/) closes the loop. [The data platform vendor's comparison](https://promethium.ai/guides/ai-agent-data-governance-vs-traditional-data-governance/) argues that agent governance has to trace how the agent used data to reach its answer, beyond where the data came from. When a classification travels with data through lineage, a masked email in the source stays masked in the derived table the agent queries three hops later. Context Maturity Assessment See where your organization sits on the maturity curve before a regulator or customer asks first. Take the Assessment --- ## Who writes and maintains the rules that AI agents read? The people who [own governance](https://atlan.com/know/ai-agent/who-owns-ai-governance-caio-vs-cdo-vs-cto/) today, with sharper roles. [Smith's TechTarget guide](https://www.techtarget.com/data-technologies/tip/How-to-use-AI-to-enforce-data-governance-policies) has governance managers set strategy and monitor the AI tools, data owners stay accountable for classification and access decisions, and stewards resolve ambiguous cases. High-risk cases route to a person through a defined escalation path. [Lopez's guide](https://airbyte.com/agentic-data/data-governance-ai-agents) splits production duties further. Data owners approve sources and fields. Security teams manage agent identities and credentials. [Platform teams](https://atlan.com/know/ai-agent/ai-platform-team-playbook/) enforce retrieval policy, and application owners govern what actions agents take. Every access decision gets a named owner. Rollout works in stages. [The observability vendor's guide](https://www.acceldata.io/blog/how-governance-aware-ai-agents-enforce-data-policies) describes four phases (visibility, recommendation, prevention, optimization) and a [shadow mode](https://atlan.com/know/shadow-deployment-for-ml-models/) where agents flag violations without blocking, so teams tune accuracy before enforcement. [The cloud provider's framework](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization) gives the same advice: start with an audit-based model, then tighten. Start where a wrong answer costs most; Smith names customer, financial and healthcare data. A fuller sequence for governance teams is in [context layer for data governance teams](https://atlan.com/know/ai-agent/context-layer-for-data-governance-teams/), and teams on AWS can compare it with [what AWS documents about data governance and what a context layer adds for AI agents](https://atlan.com/aws-data-governance-benefits/). --- ## How does Atlan make governance rules readable by AI agents? Atlan delivers governance as context agents read at request time. The [Atlan MCP server](https://atlan.com/mcp/) is a hosted remote server that hands certified definitions, [column-level lineage](https://atlan.com/know/ai-readiness/ai-ready-data-lineage/), ownership, certification status, classification tags and access rules to AI tools including Claude, ChatGPT, Gemini, Cursor, [Microsoft Copilot Studio](https://atlan.com/know/ai-agent/ai-agent-applications/what-are-microsoft-copilot-studio-agents/), [Snowflake Cortex](https://atlan.com/know/snowflake/snowflake-cortex-explained/) and [Databricks Genie](https://atlan.com/know/ai-agent/databricks/databricks-genie-context-requirements/), across more than 400 source systems. Atlan runs those calls as the signed-in user over OAuth, so the user's [roles, personas and access rules](https://atlan.com/know/ai-agent/context-layer/context-layer-role-based-access-control/) apply to whatever the agent asks. Classification tags can propagate through lineage, so a PII tag on a source column reaches the downstream tables an agent is likelier to query. Only metadata passes through the server, never row-level data, and tool calls are logged with sensitive fields masked. When an agent edits a description, tag or glossary term, Atlan marks the change "Updated using Atlan AI" in the audit trail, so stewards can review agent work. Workday is one example. Joe DosSantos, VP of Enterprise Data and Analytics at Workday, says [Atlan captures Workday's shared language for AI through its MCP server](https://atlan.com/mcp/), and that the two teams are co-building the [semantic layer](https://atlan.com/know/semantic-layer/) AI needs. Atlan in Action: Live Context Layer Demos Watch how Atlan turns risk classification, lineage, and policy into one live, queryable context graph. Watch the Live Demo Book a Demo --- ## FAQs about why governance should be exposed to agents ### Can an AI agent follow a governance policy written in a PDF? Only after someone converts it. An agent reading a PDF at run time has to interpret intent, which is where errors creep in. The reliable pattern turns each policy into tags, classifications and access rules on specific assets, so the agent or its tool layer looks up a precise answer before every query instead of guessing what the author meant. ### Does making governance rules readable to agents expose sensitive data? No. A readable rule exposes the rule, such as "this column is PII, mask it for this role," while the data stays behind the usual controls. The agent learns what it may not touch. Combined with identity inheritance, as one cloud provider's framework recommends, an agent acting for a user gets only that user's permissions. ### Is MCP enough to govern what AI agents can access? MCP gives agents a structured, bounded way to reach tools and data, and one cloud provider's framework recommends allowing only trusted MCP servers. A data integration vendor's guide notes that MCP does not enforce application-specific authorization on its own. Teams still need per-tool permission checks, agent identity bound to the delegating user, and governance rules the server can read. ### How do machine-readable rules help with the EU AI Act? Article 12 requires high-risk AI systems to record events automatically over their lifetime. With machine-readable rules, each log entry can name the rule that allowed or blocked an action, turning a raw event log into evidence of a decision. That record is far easier to defend in an audit than a log with no policy result. --- ## Sources 1. [A data platform vendor's comparison of agent and traditional governance](https://promethium.ai/guides/ai-agent-data-governance-vs-traditional-data-governance/) 2. [2026 risk forecast from a data security vendor](https://www.kiteworks.com/cybersecurity-risk-management/ai-agent-data-governance-why-organizations-cant-stop-their-own-ai/) 3. [Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027, Gartner](https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027) 4. [TechTarget guide to AI-enforced governance](https://www.techtarget.com/data-technologies/tip/How-to-use-AI-to-enforce-data-governance-policies) 5. [A data observability vendor's guide](https://www.acceldata.io/blog/how-governance-aware-ai-agents-enforce-data-policies) 6. [One cloud provider's AI agent governance framework](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization) 7. [A data integration vendor's guide to agent data governance](https://airbyte.com/agentic-data/data-governance-ai-agents) 8. [Article 12 of the EU AI Act](https://artificialintelligenceact.eu/article/12/)